-
Notifications
You must be signed in to change notification settings - Fork 42
/
ChangeLog
1675 lines (1070 loc) · 56.5 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2021-11-19 Arthur de Jong <[email protected]>
* [6e7e878] man/nslcd.conf.5.xml, nslcd/cfg.c: Support DNSLDAPS
in uri
This supports both `uri DNSLDAPS` and `uri DNSLDAPS:some.domain`
variants alongside the pre-existing `uri DNS` that was already
supported generating ldaps URIs for all SRV records found.
2021-11-15 Arthur de Jong <[email protected]>
* [70819ae] configure.ac, tests/common.h: Fix internal assertion
function detection on Solaris
2021-11-15 Arthur de Jong <[email protected]>
* [7b2a7fe] INSTALL, ar-lib, compile, depcomp, missing, py-compile,
test-driver: Update files from latest automake
2021-11-14 Arthur de Jong <[email protected]>
* [9edf95c] tests/test.ldif, tests/test_ldapcmds.sh,
tests/test_nsscmds.sh: Do not use user arthur in tests
This makes it more complicated to run the tests on an environment
where a local user arthur exists.
2021-11-14 Arthur de Jong <[email protected]>
* [2862447] pynslcd/mypidfile.py: Fix running pynslcd without
uid option
Fixes 65695aa
2021-06-04 Ryan Tandy <[email protected]>
* [15f67be] tests/config.ldif, tests/setup_slapd.sh: Support
running tests with OpenLDAP 2.5
- Change database backend to LMDB - Load external ppolicy schema
conditionally
2021-11-03 Arthur de Jong <[email protected]>
* [4c46eef] .github/workflows/test.yml: Configure CodeQL code
scanning
2021-11-01 Arthur de Jong <[email protected]>
* [906035b] man/nslcd.conf.5.xml, nslcd/cfg.c, tests/test_cfg.c:
Support an empty search base
This allows putting `base ""` in nslcd.conf to specify an empty
search base.
Note that the LDAP server needs to support this. With slapd this
requires setting up an olcDefaultSearchBase attribute in the
olcFrontendConfig object under cn=config or have the database
have an empty suffix.
Closes https://github.com/arthurdejong/nss-pam-ldapd/issues/50
2021-10-17 Arthur de Jong <[email protected]>
* [7d81616] common/expr.c, tests/test_expr.c: Support minus
character in attribute expressions
This requires the attribute name is contained within a ${var-name}
expression.
2021-05-25 Arthur de Jong <[email protected]>
* [6d5a2eb] nslcd/myldap.c: Retry connecting to the first URI
after idle_timelimit
This ensures that a connection to the first URI listed in the
config file will be re-established once the connection is closed
cleanly after the idle time.
This ensures that the listed URIs are handled more in a
primary/fallback manner if an idle time is configured.
Closes https://github.com/arthurdejong/nss-pam-ldapd/issues/46
2021-05-26 Arthur de Jong <[email protected]>
* [5226a6f] .github/workflows/test.yml, .travis.yml,
tests/setup_slapd.sh, tests/test_nsscmds.sh: Replace Travis with
GitHub actions
This includes a few tweaks to the test scripts to make debugging
easier and to avoid issues on Github action runners.
2021-01-23 Arthur de Jong <[email protected]>
* [d9710a2] man/nslcd.conf.5.xml, nslcd/cfg.c: Add tls_reqsan to
check certificate SAN
This option is passed to the LDAP library if it is supported.
2021-01-23 Arthur de Jong <[email protected]>
* [026f08c] man/nslcd.conf.5.xml, nslcd/cfg.c: Add tls_crlfile to
check local CRL file
This option is passed to the LDAP library if it is supported.
2021-01-18 sebastienblavier
* [78c00f1] man/nslcd.conf.5.xml, nslcd.conf, nslcd/cfg.c: Add
tls_crlcheck to check Certificate Revocation List
This option is passed to the LDAP library if it is supported.
Closes https://github.com/arthurdejong/nss-pam-ldapd/pull/41
2021-01-17 Arthur de Jong <[email protected]>
* [d55bdb2] Makefile.am: Use the provided Python for `make distcheck`
This ensures that if a Python interpreter was previously
supplied to configure it is also used for subsequent calls to
run a distribution check.
2021-01-17 Arthur de Jong <[email protected]>
* [b7b812f] ar-lib, compile, depcomp, install-sh, missing,
mkinstalldirs, py-compile, test-driver: Update files from
latest automake
2020-09-11 Arthur de Jong <[email protected]>
* [37a00e9] nslcd/myldap.c: Fix handling of the pam_authc_ppolicy
option
Check the result of the BIND operation instead of that of the
ldap_result() call when pam_authc_ppolicy is set to "no".
This could have resulted in successful authentication if the BIND
operation to the LDAP server timed out and pam_authc_ppolicy was
set to "no" but should not result in successful authentication
otherwise so it is unlikely that setting pam_authc_ppolicy to
"no" ever worked as intended. The timeout also would have to
occur on the BIND operation, not on setting up the connection.
Fixes 31cd2cf
2020-04-19 Arthur de Jong <[email protected]>
* [18740fb] README: Fix typo
Thanks Filip Dvorak
See https://bugzilla.redhat.com/show_bug.cgi?id=1825240
2020-02-10 Arthur de Jong <[email protected]>
* [b335518] man/nslcd.conf.5.xml: Fix typo in manual page
Thanks Benedict Reuschling for pointing this out.
Closes https://github.com/arthurdejong/nss-pam-ldapd/issues/39
Fixes b93838d
2019-11-11 Arthur de Jong <[email protected]>
* [548efe5] nslcd/myldap.c: Log the correct timeout value
This fixes logging of the LDAP_OPT_TIMEOUT,
LDAP_OPT_NETWORK_TIMEOUT and LDAP_X_OPT_CONNECT_TIMEOUT options
to actually log the value of the bind_timelimit option instead
of the timelimit option.
2019-10-13 Arthur de Jong <[email protected]>
* [fea0f5e] pynslcd/cfg.py, pynslcd/pam.py: Add pam_authc_ppolicy
support in pynslcd
See https://bugs.debian.org/900253
2019-10-13 Arthur de Jong <[email protected]>
* [1025d5d] utils/chsh.py, utils/shells.py: Fix Python 3
compatibility in chsh.ldap
2019-10-06 Arthur de Jong <[email protected]>
* [c4daf27] AUTHORS, ChangeLog, NEWS, configure.ac,
man/chsh.ldap.1.xml, man/getent.ldap.1.xml, man/nslcd.8.xml,
man/nslcd.conf.5.xml, man/pam_ldap.8.xml, man/pynslcd.8.xml,
nslcd/nslcd.c, utils/cmdline.py: Get files ready for 0.9.11 release
2019-10-06 Arthur de Jong <[email protected]>
* [69922e3] tests/test_doctest.sh: Fix Python interpreter detection
in tests
Fixes 644bc62
2019-10-06 Arthur de Jong <[email protected]>
* [62522b9] tests/test_nsscmds.sh: Portability improvements to
test suite
Some test systems have more local users and some systems prefer
IPv4 addresses over IPv6 addresses.
2019-09-17 Arthur de Jong <[email protected]>
* [a8f4ed8] NEWS, common/expr.c, common/nslcd-prot.c,
common/nslcd-prot.h, common/tio.c, compat/attrs.h, compat/ether.c,
compat/getopt_long.c, compat/getopt_long.h, compat/getpeercred.h,
compat/nss_compat.h, configure.ac, man/nslcd.conf.5.xml,
nslcd.h, nslcd/attmap.h, nslcd/common.h, nslcd/daemonize.h,
nslcd/invalidator.c, nslcd/myldap.c, nslcd/myldap.h, nslcd/pam.c,
nslcd/passwd.c, nss/common.h, nss/hosts.c, nss/prototypes.h,
pam/common.h, tests/common.h, tests/test_pynslcd_cache.py,
tests/test_tio.c, utils/getent.py: Various spelling fixes
2019-09-10 Arthur de Jong <[email protected]>
* [644bc62] .travis.yml, tests/test_doctest.sh: Fix Python
interpreter detection
Apparently some environments provide certain Python executables
which are not working Python interpreters.
2019-09-08 Arthur de Jong <[email protected]>
* [768c4be] .gitignore, Makefile.am: Remove confinc.out which is
left behind by aclocal.m4
2019-09-08 Arthur de Jong <[email protected]>
* [0252b05] pynslcd/shadow.py: Correctly validate shadow requests
and responses
2019-09-08 Arthur de Jong <[email protected]>
* [cd887ef] pynslcd/Makefile.am, utils/Makefile.am: Update Python
interpreter in installed scripts
Ensure that the Python interpreter that is passed to configure
ends up in the shebang of the Python scripts.
This allows one to pass PYTHON=python3 to configure to install
the scripts using the Python 3 interpreter.
2019-09-07 Arthur de Jong <[email protected]>
* [d717795] .gitignore, pynslcd/alias.py,
pynslcd/attmap.py, pynslcd/cache.py, pynslcd/cfg.py,
pynslcd/common.py, pynslcd/ether.py, pynslcd/expr.py,
pynslcd/group.py, pynslcd/host.py, pynslcd/invalidator.py,
pynslcd/mypidfile.py, pynslcd/netgroup.py, pynslcd/network.py,
pynslcd/pam.py, pynslcd/passwd.py, pynslcd/protocol.py,
pynslcd/pynslcd.py, pynslcd/rpc.py, pynslcd/search.py,
pynslcd/service.py, pynslcd/shadow.py, pynslcd/tio.py,
tests/Makefile.am, tests/flake8.ini, tests/test_flake8.sh,
tests/test_pynslcd_cache.py, utils/chsh.py, utils/getent.py,
utils/nslcd.py, utils/users.py: Improve Python code style
This also adds a flake8 test that checks code style. Note that
this test is not run by default because it requires network
access to create the virtualenv with the test software.
2019-09-02 Arthur de Jong <[email protected]>
* [221ce5a] configure.ac, pynslcd/Makefile.am, pynslcd/attmap.py,
pynslcd/cache.py, pynslcd/cfg.py, pynslcd/common.py,
pynslcd/expr.py, pynslcd/invalidator.py, pynslcd/mypidfile.py,
pynslcd/pam.py, pynslcd/pynslcd.py, pynslcd/search.py,
pynslcd/tio.py, pynslcd/usermod.py, tests/Makefile.am,
tests/test_doctest.sh, tests/test_ldapcmds.sh,
tests/test_pycompile.sh, tests/test_pylint.sh,
tests/test_pynslcd_cache.py, utils/Makefile.am, utils/getent.py,
utils/nslcd.py: Add Python 3 support
This ensures that both pynslcd and the command-line utilities
work with Python3 as interpreter and runs some tests with all
installed Python interpreters.
This drops support for Python 2.6 and extends 5a84be2 to perform
more testing with Python 3.
2018-09-08 Arthur de Jong <[email protected]>
* [06ee886] nslcd/nslcd.c: Avoid logging unknown socket peer
information
This avoids logging the client PID when the underlying socker
layer cannot provide the relevant information.
2018-09-05 Mizunashi Mana <[email protected]>
* [bfcf002] utils/shells.py: Fix crash in chsh.ldap
Specify result type of getusershell.
Closes https://github.com/arthurdejong/nss-pam-ldapd/pull/31
2018-09-01 Arthur de Jong <[email protected]>
* [bfe0696] AUTHORS, ChangeLog, NEWS, configure.ac,
man/chsh.ldap.1.xml, man/getent.ldap.1.xml, man/nslcd.8.xml,
man/nslcd.conf.5.xml, man/pam_ldap.8.xml, man/pynslcd.8.xml:
Get files ready for 0.9.10 release
2018-09-01 Arthur de Jong <[email protected]>
* [acc450e] ar-lib, compile, config.guess, config.sub, depcomp,
install-sh, missing, mkinstalldirs, py-compile, test-driver:
Update files from latest automake
2018-02-06 HWLin <[email protected]>
* [d5a25cf] configure.ac, nss/bsdnss.c: Add FreeBSD netgroup support
Closes: https://github.com/arthurdejong/nss-pam-ldapd/pull/29
2018-08-06 Arthur de Jong <[email protected]>
* [d8b1640] nslcd/myldap.c, nslcd/pam.c: Make password expiry
messages correct and consistent
Thanks to Têko Mihinto. See
https://bugzilla.redhat.com/show_bug.cgi?id=1612543
2018-07-21 Arthur de Jong <[email protected]>
* [84676ab] man/nslcd.conf.5.xml, nslcd/cfg.c, nslcd/pam.c: Add
domain variable for use in pam_authz_search
This adds a domain variable (if it can be determined on the
system) that can be used in pam_authz_search and pam_authc_search
filters to build search filters that search on the domain name
(the FQDN without the starting host name).
Closes https://github.com/arthurdejong/nss-pam-ldapd/issues/8
2018-07-21 Arthur de Jong <[email protected]>
* [9fbcdd1] .travis.yml, tests/debian-pam-config, tests/testenv.sh:
Add a Travis configuration file
This ensures that the integration tests can be successfully run. It
configures a slapd instance with the test database, configures
the system to use LDAP authentication and runs the tests.
2018-07-21 Arthur de Jong <[email protected]>
* [2a468fd] nslcd/log.c: Allow logging longer lines
This increases the buffer that holds log messages so longer
messages can be logged.
Closes https://github.com/arthurdejong/nss-pam-ldapd/issues/26
2018-07-21 Arthur de Jong <[email protected]>
* [3760b43] nslcd/nslcd.c: Create /var/run/nslcd/socket after
dropping privileges
This is needed to avoid a problem where a call to initgroups()
can result in NSS lookups. If nscd is configured the mechanism
to avoid loopback lookups using nss_ldap_enablelookups will not
work and cause for delays on start-up.
Note that this changes ownership of the socket to the user
running nslcd.
2018-02-18 Arthur de Jong <[email protected]>
* [fe26b94] ChangeLog, NEWS, README, configure.ac,
man/chsh.ldap.1.xml, man/getent.ldap.1.xml, man/nslcd.8.xml,
man/nslcd.conf.5.xml, man/pam_ldap.8.xml, man/pynslcd.8.xml:
Get files ready for 0.9.9 release
2018-02-18 Arthur de Jong <[email protected]>
* [382b6ea] INSTALL, ar-lib, config.guess, config.sub, depcomp,
py-compile: Update files from latest automake
2018-02-17 Arthur de Jong <[email protected]>
* [e8a4705] tests/test_pylint.sh: Fix running pylint on distcheck
This sets PYTHONPATH so that both the source and build directories
are used to find constants.py.
2018-02-17 Arthur de Jong <[email protected]>
* [9a50971] common/expr.c, compat/attrs.h: Mark case blocks without
break statement
This avoids a gcc warning in non-empty case blocks without a
break statement by explicitly marking those blocks.
2018-02-16 Arthur de Jong <[email protected]>
* [c05e326] nslcd/cfg.c, nslcd/common.h: Increase size of hostname
buffer
This increases the host name buffer to support host names (that
include FQDNs) to 255 characters and removes the reliance on
HOST_NAME_MAX and _POSIX_HOST_NAME_MAX which may be smaller in
some situations.
Closes https://github.com/arthurdejong/nss-pam-ldapd/issues/22
2017-12-23 Arthur de Jong <[email protected]>
* [9760dce] nslcd/cfg.c: Increase size of config file token
This increases the maximum size of tokens that are read from
the nslcd.conf configuration file to 256 characters. This was
a problem for some very long uri values.
Closes https://github.com/arthurdejong/nss-pam-ldapd/issues/21
2017-10-13 Arthur de Jong <[email protected]>
* [8f76d24] nslcd/cfg.c, tests/test_cfg.c: Support spaces in
attribute mapping expressions
2017-06-26 Arthur de Jong <[email protected]>
* [47fd03b] AUTHORS, ChangeLog, NEWS, configure.ac,
man/chsh.ldap.1.xml, man/getent.ldap.1.xml, man/nslcd.8.xml,
man/nslcd.conf.5.xml, man/pam_ldap.8.xml, man/pynslcd.8.xml,
nslcd/nslcd.c, pynslcd/pynslcd.py, utils/cmdline.py: Get files
ready for 0.9.8 release
2017-06-25 Arthur de Jong <[email protected]>
* [7920d85] tests/test_ldapcmds.sh, tests/test_nsscmds.sh: Ignore
password hashes in consistent manner
This changes the getent and getent.ldap tests to ignore password
hashes that may be present in shadow lookups in a consistent
manner.
This also adds minor compatibility improvements.
2017-06-25 Arthur de Jong <[email protected]>
* [65695aa] pynslcd/cfg.py, pynslcd/mypidfile.py, pynslcd/pynslcd.py:
Create pidfile directory in pynslcd
This ensures that /var/run/nslcd is created (when it does not
exist) when starting pynslcd.
2017-06-25 Arthur de Jong <[email protected]>
* [419aab2] pynslcd/cfg.py, pynslcd/group.py, pynslcd/passwd.py:
Add nss_uid_offset and nss_gid_offset to pynslcd
2017-03-20 Seth Wright <[email protected]>
* [5103173] man/nslcd.conf.5.xml, nslcd/cfg.c, nslcd/cfg.h,
nslcd/group.c, nslcd/passwd.c: Add the ability to offset UID
and GID numbers
2017-06-18 Arthur de Jong <[email protected]>
* [fee74d9] tests/Makefile.am, tests/test_ldapcmds.sh: Portability
improvements to test_ldapcmds.sh
This fixes an issue with the export statement in POSIX shell
scripts, ensures that the commands in the output match those
in the script, strips password hashes for shadow lookups (for
systems without PAM where these are exposed) and only runs the
tests if we enabled the utils.
Fixes 246a1f3.
2017-06-17 Arthur de Jong <[email protected]>
* [5126b26] nslcd/ether.c: Use uint8_t instead of u_int8_t
The former seems to be available on more platforms than the latter.
Fixes be26510.
2017-06-17 Arthur de Jong <[email protected]>
* [fe3772f] compat/pam_compat.h: Fix HAVE_DECL_PAM_ERROR usage
The macro is supposed to be defined to 0 (instead of undefined)
if pam_info() and pam_error() are not found.
Fixes 3d5ab89.
2017-06-17 Arthur de Jong <[email protected]>
* [ca62f59] nslcd/shadow.c: Also filter shadow entries by validnames
2017-06-17 Arthur de Jong <[email protected]>
* [e68b85a] nslcd/passwd.c, nslcd/shadow.c: Fix and clarify a
few comments
2017-06-16 Arthur de Jong <[email protected]>
* [3d5ab89] compat/pam_compat.h, configure.ac: Fix pam_info()
and pam_error() replacement
On FreeBSD these are functions while on Linux they are macros
causing them to be incorrectly replaced on FreeBSD. This resulted
in a crash of the PAM module when e.g. presenting messages about
password expiry.
2017-06-16 Arthur de Jong <[email protected]>
* [b5d1dd2] tests/Makefile.am: Clean log from test_pamcmds.expect
This removes test_pamcmds.log that is generated by
test_pamcmds.expect when running the test suite. This avoids an
error in the distcheck target.
2017-06-16 Arthur de Jong <[email protected]>
* [246a1f3] tests/test_ldapcmds.sh: Fix running test_ldapcmds.sh
during distcheck
This ensures that Python can find both getent.py (from source
directory) and constants.py (from build directory) when running
the tests from the distcheck target.
This also makes the script more similar to test_nsscmds.sh.
Fixes 9c803d7.
2017-06-15 Arthur de Jong <[email protected]>
* [43862ba] : Add pam_authc_search option
This option can be used to configure the search operation that
should be performed after authentication.
2017-06-15 Arthur de Jong <[email protected]>
* [5141b09] man/nslcd.conf.5.xml, nslcd/pam.c: Allow skipping
post-authentication search altogether
2017-06-14 Arthur de Jong <[email protected]>
* [0cafb08] nslcd/myldap.c, nslcd/myldap.h, nslcd/pam.c,
nslcd/usermod.c: Implement myldap_bind() function
This function integrates the myldap_set_credentials() and
myldap_get_policy_response() and performs the bind operation
witout actually performing a search.
The function performs a "fake" search that returns after performing
the LDAP BIND operation.
This replaces a number of dummy search operations that were there
to ensure that the connection was open. This allows us to skip
the search operation after authentication.
2017-06-14 Arthur de Jong <[email protected]>
* [9564dd0] nslcd/pam.c: Implement handling of pam_authc_search
option
This allows performing a different, configurable search from
the default BASE search after the BIND operation.
2017-06-14 Arthur de Jong <[email protected]>
* [f72aaa2] man/nslcd.conf.5.xml: Document pam_authc_search option
2017-06-14 Arthur de Jong <[email protected]>
* [5d11cb8] nslcd/cfg.c, nslcd/cfg.h, nslcd/pam.c: Add
pam_authc_search option parsing
2017-06-14 Arthur de Jong <[email protected]>
* [bcc3a08] nslcd/pam.c, pynslcd/pam.py: Reorganise PAM search
var building functions
This moves the autzsearch_var_add(), autzsearch_vars_free(),
autzsearch_var_get() and do_autzsearches() functions to the top of
the file using more generic names and introduces search_vars_new()
in prepartion of other similar searches.
This also renames the remaining authzsearch functions to
authz_search to be consistent with the pam_authz_search option.
2017-06-13 Arthur de Jong <[email protected]>
* [ebc0f76] README, configure.ac, tests/test.ldif: Switch to
HTTPS URLs
2017-06-13 Arthur de Jong <[email protected]>
* [be26510] compat/ether.c, compat/ether.h, configure.ac,
nslcd/ether.c, pynslcd/ether.py: Query ethernet addresses in
compact and long format
This ensures that when querying the address 0:18:8a:54:1a:8b
both that format and 00:18:8a:54:1a:8b is searched for in LDAP.
This was triggerred by the fact that ether_ntoa() on FreeBSD
returns the long format while glibc uses the compact format.
Since we are no longer using the libc version of ether_ntoa() we
can also drop the compatibility implementation of ether_ntoa_r().
2017-06-07 Arthur de Jong <[email protected]>
* [becc883] nslcd/passwd.c: Log entries and lookups failing
nss_min_uid
This logs (at debug level) any LDAP uidNumber attribute values
(or translated objectSid attribute values) that are lower than
nss_min_uid. It also logs getpwuid() requests for such uids.
2017-06-04 Arthur de Jong <[email protected]>
* [5a84be2] utils/chsh.py, utils/cmdline.py, utils/getent.py,
utils/nslcd.py, utils/shells.py, utils/users.py: Make nslcd-utils
Python 3 compatible
This changes the getent.ldap and chsh.ldap commands to be
compatible with Python 2 and Python 3 with the same code.
This does switch to raw I/O because Python 3 does not support
bufferred I/O on sockets.
2017-06-04 Arthur de Jong <[email protected]>
* [9c803d7] tests/Makefile.am, tests/test_ldapcmds.sh,
tests/test_nsscmds.sh, tests/testenv.sh: Add tests for getent.ldap
command
This more or less duplicates the tests from test_nsscmds.sh to
test_ldapcmds.sh with some modifications for the differences
in output.
This also extends the test_nsscmds.sh tests to handle the case
where shadow lookups do not go through LDAP.
2017-06-04 Arthur de Jong <[email protected]>
* [a357131] utils/getent.py: Fix output of getent.ldap networks
Contrary to the hosts output the network name is listed first.
2017-06-03 Arthur de Jong <[email protected]>
* [58c7a94] utils/getent.py: Fix IPv6 lookups in getent.ldap
2017-06-03 Arthur de Jong <[email protected]>
* [5173e55] man/getent.ldap.1.xml, utils/getent.py: Accept multiple
key arguments to getent.ldap
This allows supplying multiple arguments to getent.ldap that
will each act as a search key for lookups, similar to what normal
getent allows.
2017-02-07 Arthur de Jong <[email protected]>
* [53f797b] nslcd/nslcd.c: Exit with 0 when stopping nslcd
When receiving a signal this will result in nslcd returning with
a success exit code.
Thanks Stanislav Moravec for pointing this out.
2016-09-04 Arthur de Jong <[email protected]>
* [c12cd14] nslcd/nslcd.c: Remove duplicate break statement
2016-09-04 Arthur de Jong <[email protected]>
* [d8ad7b1] nslcd/myldap.c: Do not try all LDAP servers on failed
authentication
See https://bugs.launchpad.net/bugs/1618190
2016-08-30 Arthur de Jong <[email protected]>
* [a3da150] utils/nslcd.py: Replace Python assertions with exceptions
The assertions can be optimised out when compiling the modules
with -O which would break the protocol handling. This ensures
that errors are properly handled even if optimisation is enabled.
Thanks Yu-Chun Huang for reporting this.
https://github.com/arthurdejong/nss-pam-ldapd/issues/14
2016-08-14 Arthur de Jong <[email protected]>
* [c286bb5] AUTHORS, ChangeLog, NEWS, README, configure.ac,
man/chsh.ldap.1.xml, man/getent.ldap.1.xml, man/nslcd.8.xml,
man/nslcd.conf.5.xml, man/pam_ldap.8.xml, man/pynslcd.8.xml,
nslcd/nslcd.c, pynslcd/pynslcd.py, utils/cmdline.py: Get files
ready for 0.9.7 release
2016-08-14 Arthur de Jong <[email protected]>
* [db9494e] tests/Makefile.am: Only run doctests when building
pynslcd
2016-08-14 Arthur de Jong <[email protected]>
* [cb16e4c] nss/bsdnss.c: Avoid some warnings on FreeBSD
This adds casts to and from void * for the function pointers
that are passed around.
2016-07-27 Arthur de Jong <[email protected]>
* [b7a0b23] ChangeLog, ChangeLog-2013, Makefile.am: Archive 2013
ChangeLog entries
2016-07-27 Arthur de Jong <[email protected]>
* [e4df12c] config.guess, config.sub, install-sh: Update files
from latest automake
2016-07-27 Arthur de Jong <[email protected]>
* [db8034a] man/Makefile.am, utils/Makefile.am, utils/getent.py:
Also use module-name in utilities and man pages
This ensures that getent.ldap, chsh.ldap and manual pages with
ldap in the name will be installed with the name as specified
with --with-module-name.
Note that the manual page content still describes the working
within nss-pam-ldapd and still mention the ldap name.
2016-06-04 Arthur de Jong <[email protected]>
* [281b0ec] tests/test_doctest.sh: Ensure doctest also run in
distcheck
This fixes test_doctest.sh to also work when the build directory
is different from the source directory. This is needed because
constants.py is only available in the build directory.
2016-06-03 Arthur de Jong <[email protected]>
* [a89eda7] nslcd/pam.c: Also honor ignorecase in PAM
This avoids changing the cannonical username to the value as
specified in LDAP when ignorecase is used.
See https://github.com/arthurdejong/nss-pam-ldapd/issues/12
2016-06-03 Arthur de Jong <[email protected]>
* [7eb1d69] pynslcd/expr.py: Support ${var:offset:length} in pynslcd
2016-06-02 Arthur de Jong <[email protected]>
* [c90a537] pynslcd/attmap.py: Fix pynslcd expression representation
The problem was that the ExpressionMapping string value did not
include the quotes which will cause problems when printing the
expression (e.g. when logging or dumping config, etc.).
2016-06-02 Arthur de Jong <[email protected]>
* [fd61bb6] tests/Makefile.am, tests/test_doctest.sh: Add test
for running doctests
2016-05-30 Giovanni Mascellani <[email protected]>
* [2ba9560] common/expr.c, man/nslcd.conf.5.xml, tests/test_expr.c:
Support substituting expresions of type ${var:offset:length}
2016-05-30 Giovanni Mascellani <[email protected]>
* [3a4860c] man/nslcd.conf.5.xml: Fix small typo
2016-05-24 Arthur de Jong <[email protected]>
* [917ded7] common/expr.c: Refactor out expression parsing to
functions
This moves the parsing of the various ${var...} expressions to
separate functions so they can be extended more easily.
2016-02-22 Arthur de Jong <[email protected]>
* [4be9c59] pam/pam.c: Fix logic error
This could result in a free(NULL) call. This code path can
only be triggered if pam_ldap changes the logged-in username
(introduced in 6a74d8d).
Thanks 依云, see
https://github.com/arthurdejong/nss-pam-ldapd/issues/11
2016-01-30 Mathieu Baeumler <[email protected]>
* [985aec3] nslcd/myldap.c: Display human readable expiry message
Display a human readable message (days+hours, or hours+minutes,
or seconds) when the password expiring warning is issued.
2016-02-13 Arthur de Jong <[email protected]>
* [b795f6c] nslcd/cfg.c: Fix nss_disable_enumeration configuration
This fixes a copy-paste bug where nss_disable_enumeration was
incorrectly handled. Fixes c0366d8.
Thanks Andrew W Elble for pointing this out.
2016-01-18 Arthur de Jong <[email protected]>
* [525c996] tests/test.ldif, tests/test_nsscmds.sh: Add a few
IPv6 tests
This adds a few test hosts that have IPv6 addresses. This
ensures that we have an IPv6-only host and hosts which have
address values in different order in the ipHostNumber attribute
(although attribute order is probably not guaranteed).
2015-10-18 Mathieu Baeumler <[email protected]>
* [31cd2cf] man/nslcd.conf.5.xml, nslcd/cfg.c, nslcd/cfg.h,
nslcd/myldap.c: Add pam_authc_ppolicy option
This option allows completely disabling ppolicy handling.
2016-01-06 Arthur de Jong <[email protected]>
* [117c9cb] nslcd/pam.c: Fix error handling on credential change
This fixes setting the correct LDAP error code and also fixes
formatting in 027df03.
2015-12-23 Vasilis Tsiligiannis <[email protected]>
* [027df03] nslcd/pam.c: Fix updating of 'shadowLastChange'
attribute when chasing referrals
This fixes a bug where 'shadowLastChange' attribute cannot be
updated when chasing a referral. After a password is succesfully
changed, the credentials for binding should also be updated with
the new password for the session.
Signed-off-by: Vasilis Tsiligiannis
2015-11-13 Arthur de Jong <[email protected]>
* [fcea92d] nslcd/cfg.c: Correct file readability check
This uses access() instead of stat() to see if the file is
readable by the current process. This fixes f089e01.
2015-09-20 Arthur de Jong <[email protected]>
* [c879485] nslcd/myldap.c: Fail-over and retry on more errors
Also try to fail over to another LDAP server on a larger number
of errors. Specifically errors that point to problems connecting
to the LDAP server.
2015-08-29 Arthur de Jong <[email protected]>
* [3d09e28] nslcd/myldap.c: Open connection before do_try_search()
This is in preparation for splitting the BIND from the search
phase for authentication.
2015-08-27 Arthur de Jong <[email protected]>
* [f089e01] nslcd/cfg.c: Loosen up file existence check
This changes the check (for configuration options that specify
file names) to just check that the specified path is readable
instead of ensisting that it points to a file.
This allows tls_randfile to point to /dev/urandom (a character
device) or a pipe. This fixes 6779a51.
This also applies the same check to the krb5_ccname option.
Thanks to Patrick McLean for pointing this out.
2015-08-14 Arthur de Jong <[email protected]>
* [309f127] pam/pam.c: Have PAM module log messages to syslog
This logs informational messages that are presented to the user
tot syslog. This normally includes password expiry and grace
login information which may be useful to log.
2015-08-14 Arthur de Jong <[email protected]>
* [263a443] nslcd/myldap.c: Simplify password policy message handling
This simplifies the check for overwriging pending password
expiry and grace logins warnigns and updates handling of the
LDAP_CONTROL_PWEXPIRING control to be consistent with that of
the expire value of LDAP_CONTROL_PASSWORDPOLICYRESPONSE.
This also corrects the function name, also logs empty password
policy responses in debug mode and documents the meaning of the
various password policy values.
2015-07-09 Mathieu Baeumler <[email protected]>
* [4302901] nslcd/myldap.c: Fix password policy expiration warnings
If a password expiration warning (pwdExpireWarning) is set in
slapd, and the password is about to expire, slapd sends the
timeBeforeExpiration value as part of the passwordPolicyResponse.
nslcd would incorrectly instruct the PAM module to require
immediate password change. This has been fixed for both
timeBeforeExpiration and graceLoginsRemaining.
2015-07-19 Arthur de Jong <[email protected]>
* [89b471b] ar-lib, autogen.sh, compile, configure.ac, depcomp,
install-sh, missing, py-compile, test-driver: Update files from
automake 1.15
This also includes the m4 directory when invoking aclocal because
not all versions seem to handle AC_CONFIG_MACRO_DIR.
2015-07-19 Arthur de Jong <[email protected]>
* [86a4618] m4/ax_tls.m4: Disable quoting in AX_TLS notfound case
This ensures that AS_IF does not generate an empty else clause
which will result in an invalid configure script.
2015-07-19 Arthur de Jong <[email protected]>
* [6779a51] nslcd/cfg.c: Check file existence for configuration
options
This adds addition checks to the tls_cacertdir, tls_cacertfile,
tls_randfile, tls_cert and tls_key options to ensure that they
point to an existing file when parsing nslcd.conf.
2015-07-19 Arthur de Jong <[email protected]>
* [a6c7c63] pynslcd/pynslcd.py: Work around bug in python-daemon
See https://bugs.debian.org/792871
2015-07-08 Arthur de Jong <[email protected]>
* [c32e8c0] m4/ax_pthread.m4, m4/ax_tls.m4: Update macros from
autoconf-archive
2015-06-14 Arthur de Jong <[email protected]>
* [d949bd4] AUTHORS, ChangeLog, NEWS, configure.ac,
man/chsh.ldap.1.xml, man/getent.ldap.1.xml, man/nslcd.8.xml,
man/nslcd.conf.5.xml, man/pam_ldap.8.xml, man/pynslcd.8.xml:
Get files ready for 0.9.6 release
2015-06-14 Arthur de Jong <[email protected]>
* [4236dd6] Makefile.am: Correctly insert emtpy lines in ChangeLog
2015-06-13 Arthur de Jong <[email protected]>
* [e916a2b] man/nslcd.conf.5.xml: Manual page improvements
2015-06-13 Arthur de Jong <[email protected]>
* [9a7921f] nslcd/common.c, nslcd/common.h: Also fix signed integer
bug in binsid2id()
This should have been part of d217632.
2015-06-11 Geoffrey McRae <[email protected]>
* [d217632] nslcd/common.c: Fixed signed 32bit overflow bug on
32bit systems
2015-05-23 Jed Liu <[email protected]>
* [3add5f0] nslcd/cfg.c: Allow configuration values longer than
63 characters
2015-03-06 Arthur de Jong <[email protected]>
* [d58fba9] nss/netgroup.c: Provide innetgr function on Solaris
This implements a function in the Solaris version of the NSS module
to check if a specifc netgroup triplet is part of a netgroup.
This also avoids a compiler warning and includes improvements